Lessons from 59 Linux Kernel Bug Reports | Microsoft Security Blog

Researchers at Microsoft's FORGE Lab used AI-powered tools to scan Linux kernel subsystems, producing 59 public reports and 33 assigned CVEs over three months. The process yielded thousands of raw findings that required extensive expert human review and PoC development to validate vulnerabilities and merge fixes upstream. Among the findings, researchers examined a state-reset bug in the rhashtable library, CVE-2026-64563, which enabled local privilege escalation on Linux and Android. Open article →